Job Description

Details

-----------


###

Reference number

424203
###

Salary

61,446 - 86,547
National 61,446-80,425


London 65,835-86,547. Please ensure that you read the Pay and Reward information for civil service and internal colleagues before applying.
A Civil Service Pension with an employer contribution of 28.97%
GBP
###

Job grade

Grade 6
Level 3###

Contract type

Permanent###

Business area

OFGEM - Eserve - Digital Delivery Team###

Type of role

Digital

Information Technology

Security###

Working pattern

Flexible working, Full-time###

Number of jobs available

1

Contents

------------

Location About the job Benefits Things you need to know Apply and further information

Location

------------


Successful candidates may be based in any of our office locations - Cardiff, Glasgow, or London. We especially welcome applicants from Cardiff and Glasgow.

About the job

-----------------

###

Job summary

At the forefront of the fight to protect energy consumers, Ofgem is strengthening its internal defences because safeguarding our systems against cyber threats is vital to delivering our mission. We're looking for a Principal Cyber Security Architect to join us and lead the charge in shaping secure, resilient digital systems at the heart of our organisation.



Ofgem is Great Britain's independent energy regulator. We're at the forefront of change across the energy sector, driving towards Net Zero whilst protecting energy consumers, especially vulnerable people.



We're offering a permanent role where you'll apply your security architecture expertise to projects with strategic impact, influencing decisions at the highest level. This is an opportunity to make a tangible difference by helping us transform our technology landscape while reducing cyber risk across the organisation. Your work will ensure we stay secure by design, resilient by default, and consistently prepared for evolving threats.



You'll work at the heart of a multidisciplinary team, collaborating with internal stakeholders and leading national security partners to embed robust security into every stage of the digital lifecycle. As a recognised expert, you'll play a central role in building long-term cyber strategies and providing guidance that sets standards across our organisation and the wider energy ecosystem.



We're looking for someone with a deep understanding of security architecture and a proven track record of influencing complex programmes and senior leaders. Your approach to solving challenges will be methodical and strategic, and you'll be comfortable operating in fast-paced, high-stakes environments where your guidance truly matters.



In return, you'll join a collaborative and inclusive culture that values innovation and supports development. You'll benefit from flexible working arrangements, excellent civil service benefits, and the opportunity to be part of a high-profile mission that impacts millions of people and the UK's energy future.



We have a critical purpose to lead the development of secure digital systems and architecture within our organisation, combating cyber threats and strengthening resilience across the UK's energy landscape through trusted design, strategic leadership, and expert guidance.###

Job description

Key Responsibilities

To support the team deliverables, utilising your expertise to ensure successful outcomes across collaborating teams and strategies that can be used in the long term across the whole organisation. Leverage a variety of sources to continuously maintain Ofgem Cyber Reference Architecture with principles, requirements, patterns, anti-patterns, implementation, engineering and operational maintenance options. Influence key organisational and architectural decisions and interact with senior stakeholders across organisations to reach and influence a wide range of people across larger teams and communities. Security Architecture Design: Develop and maintain secure architecture patterns for applications and services. Threat Modelling & Risk Assessment: Conduct threat modelling and risk assessments to identify vulnerabilities and recommend mitigation strategies. Secure SDLC Integration: Embed security practices into the software development lifecycle, including code reviews, static analysis, and secure coding standards. Stakeholder Engagement: Communicate security risks and solutions effectively to technical and non-technical audiences, influencing secure design decisions. Security Testing & Validation: Oversee penetration testing, vulnerability management, scanning, and remediation activities. Policy & Compliance Alignment: Ensure application security aligns with organisational policies, GDS standards, and regulatory requirements. Innovation & Advisory: Provide expert advice on emerging security technologies and trends, including AI, cloud-native security, and zero-trust architectures.

Key Outputs and Deliverables

Use applied security expertise to develop and maintain solutions that align with Ofgem Cyber guidance, to support the improvement of cyber resilience for the organisation. Use applied security expertise to identify key programme and technical risks, leading the design of mitigating security architectures. Document expert cyber architecture design reviews of operator system architectures to identify security weaknesses, recommend mitigations and ensure security requirements are integrated into product backlogs and user stories. Identify and Document Cyber Risks within the Secure by Design lifecycle. Provide expert advice on security architecture implications of technological trends when applied to existing systems, and how innovative technologies change the security approach required. Effectively communicate difficult risk and security concepts in accessible ways that can be clearly understood by business leaders. Contribute to and develop risk communication strategies. Attend, lead and provide expert input to Specialist Interest Groups to share security best practice across the sector. Follow a methodical and repeatable approach to reviewing the security of a system architecture and describe that approach. Contribute to new and innovative security architecture guidance for others to re-use through architecture blueprints and reusable design patterns. Lead and support the development of penetration test scopes, reports, and remediation plans. ###

Person specification

Essential Criteria

Expertise in security architecture and applied security capability. (Lead criteria) Certified to one, more or equivalent of CISSP, GICSP, GRID, SABSA, or TOGAF. (Lead criteria) Knowledge of microservices, containerisation, and cloud-native security models Practitioner in information risk assessment and risk management. Experience in Secure by Design (Cabinet Office Guidance) application security, secure software design, and architecture. Experience in the process of developing and managing a range of options and decisions aligning with organisational priorities.

Lead Criteria

Experience of working in the energy sector. Experience in automated security testing. Experience with frameworks such as OWASP, NIST, ISO 27001, and CAF. ###

Behaviours

We'll assess you against these behaviours during the selection process:


Seeing the Big Picture Changing and Improving Making Effective Decisions Communicating and Influencing

Benefits

------------


Alongside your salary of 61,446, OFGEM contributes 17,800 towards you being a member of the Civil Service Defined Benefit Pension scheme. Find out what benefits a Civil Service Pension provides.
Ofgem can offer you a comprehensive and competitive benefits package which includes; 30 days annual leave after 2 years; Excellent training and development opportunities; The opportunity to join the generous Civil Service pension which also includes a valuable range of benefits; hybrid working (currently 1 day a week in the office but this is kept under review), flexible working hours and family friendly policies. Plus lots of other benefits including clean and bright offices based centrally, engaged networks and teams and an opportunity to contribute to our ambitious and important targets of establishing a Net Zero energy system by 2050. This exciting blend of professional challenge and personal reward identifies career opportunities at Ofgem as something to get excited about.

Things you need to know

---------------------------

###

Selection process details

This vacancy is using Success Profiles , and will assess your Behaviours and Experience.
When you press the 'Apply now' button, you will be asked to complete personal details (not seen by the sift panel), your career history and qualifications.


You will then be asked to provide a 1250 word 'personal statement' evidencing how you meet the essential and desirable skills and capabilities listed in the role profile. Please ensure you demonstrate clearly, within your supporting statement, how you meet each of the essential and desirable skills and capabilities.


The Civil Service values honesty and integrity and expects all candidates to abide by these principles. You must ensure that any evidence submitted as part of your application or used during interview, including your CV and any statements or examples, are truthful and factually accurate. Ofgem takes any incidences of cheating very seriously. Please ensure all examples provided are of your own experience. Any instances of plagiarism or other forms of cheating will be investigated and, if proven, the relevant applications will be withdrawn from the process. Please note that plagiarism can include presenting the ideas and experiences of others, or generated by artificial intelligence, as your own.


Please refer to Civil Service candidate advice on the acceptable use of artificial intelligence within the recruitment and selection process - Artificial intelligence and recruitment , Civil Service Careers

The personal information we have collected from you will be shared with Cifas who will use it to prevent fraud, other unlawful or dishonest conduct, malpractice, and other seriously improper conduct. If any of these are detected, you could be refused certain services or employment. Your personal information will also be used to verify your identity. Further details of how your information will be used by us and Cifas, and your data protection rights, can be found by [

https://www.cifas.org.uk/fpn

].



Feedback will only be provided if you attend an interview or assessment.###

Security

Successful candidates must undergo a criminal record check.
Successful candidates must meet the security requirements before they can be appointed. The level of security needed is security check .



See our vetting charter .
People working with government assets must complete baseline personnel security standard (opens in new window) checks.###

Nationality requirements

This job is broadly open to the following groups:


UK nationals nationals of the Republic of Ireland nationals of Commonwealth countries who have the right to work in the UK nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities with settled or pre-settled status under the European Union Settlement Scheme (EUSS) nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities who have made a valid application for settled or pre-settled status under the European Union Settlement Scheme (EUSS) individuals with limited leave to remain or indefinite leave to remain who were eligible to apply for EUSS on or before 31 December 2020 Turkish nationals, and certain family members of Turkish nationals, who have accrued the right to work in the Civil Service
Further information on nationality requirements
###

Working for the Civil Service

The Civil Service Code sets out the standards of behaviour expected of civil servants.



We recruit by merit on the basis of fair and open competition, as outlined in the Civil Service Commission's recruitment principles .
The Civil Service embraces diversity and promotes equal opportunities. As such, we run a Disability Confident Scheme (DCS) for candidates with disabilities who meet the minimum selection criteria.
The Civil Service also offers a Redeployment Interview Scheme to civil servants who are at risk of redundancy, and who meet the minimum requirements for the advertised vacancy.###

Diversity and Inclusion

The Civil Service is committed to attract, retain and invest in talent wherever it is found. To learn more please see the Civil Service People Plan and the Civil Service Diversity and Inclusion Strategy .

Apply and further information

---------------------------------


This vacancy is part of the Great Place to Work for Veterans initiative.
The Civil Service welcomes applications from people who have recently left prison or have an unspent conviction. Read more about prison leaver recruitment (opens in new window).
Once this job has closed, the job advert will no longer be available. You may want to save a copy for your records.###

Contact point for applicants

####

Job contact :

Name : Jamie Wright Email : recruitment@ofgem.gov.uk
####

Recruitment team

Email : recruitment@ofgem.gov.uk ###

Further information

Appointment to the Civil Service is governed by the Civil Service Commission's Recruitment Principles. You have the right to complain if you feel there has been a breach of these Recruitment Principles.




In the first instance, you should raise the matter directly via recruitment@ofgem.gov.uk. If you are not satisfied with the response, you may bring your complaint to the Commission. For further information on bringing a complaint to the Civil Service Commission, please visit their website.